With no special software and without actually touching the laptop, hacker Charlie Miller broke into a MacBook Air in just two minutes yesterday. This showed that the Mac laptop was also the weakest of three portable machines, the other two being a Sony Vaio and a Fujitsu U810.
The hack took place during a contest organized by TippingPoint in Vancouver, Canada. The Pwn to Own contest had two phases: during the first day, only network attacks were allowed, but none of the laptops could be broken into remotely. In the second day, rules stated that the hacker could give instructions to a staff member.
Charlie Miller, the first to try, directed the staff person to access a website using the Safari browser. The webpage contained malicious code wrote by Miller, exploiting a yet unkown vulnerability in either Mac OS X or Safari 3.1. Subsequently, he was forced by contest rules to sign a nondisclosure agreement which allows the software maker to be announced of the vulnerability.
Miller is well known in hacking circles. He also made headlines for being one of the security experts who first hacked Apple's iPhone last year. He won the MacBook Air laptop and $10,000 from TippingPoint's Zero Day Initiative.
Interestingly enough, none of the hackers managed to gain control of the Vista or Ubuntu machines. However, they will try again today.
Recently, Apple decided to introduce a download option for the Safari web browser within its iTunes music and video software. Apple’s move is not unusual as there are a lot of companies that are using the same technique in order to raise awareness on a certain product.
Though it seems that opinions differ, as some regard this as a simple promotion technique (the user is not forced into anything and can choose to click “No”), while others consider that the company is taking advantage of the trust people have in a popular software and it is trying to lure them to a new browser. Miller's demonstration of the weaknesses in Apple's latest browser further strengthen the anti-Safari-through-iTunes current.